NIST 800-171 Cost and Timeline for Small Manufacturers in 2026: Real Numbers from 12 Months of DARPA/DoD Engagements
Alexander Sverdlov
Security Analyst
Key Takeaways
- NIST SP 800-171 is 110 security controls across 14 families. CMMC 2.0 Level 2 is the same 110 controls plus an assessment requirement. They are not two standards, they are one standard with two paths to demonstrating compliance.
- If your DoD or DARPA prime contract contains DFARS clause 252.204-7012, you already had to implement NIST 800-171 since 2017. Most small shops did not, and the new CMMC 2.0 enforcement regime is closing that gap with real teeth.
- For a small precision-machining or aerospace-parts manufacturer with under 50 employees, a credible NIST 800-171 implementation costs $85,000 to $240,000 all-in over 9 to 14 months, plus $6,000 to $18,000 per year of ongoing operating cost.
- A C3PAO assessment for CMMC 2.0 Level 2 adds $35,000 to $95,000 on top of the implementation. Self-assessment is allowed for non-prioritized acquisitions but the contracting officer decides, not you.
- The single biggest cost driver is CUI scope. Most shops can shrink the assessment boundary to a single segmented network and three workstations, which cuts the implementation cost by 40 to 60 percent.
- A truthful SPRS score matters more than most owners think. Submitting an inflated score is a False Claims Act exposure; whistleblower cases against small subcontractors are now a real legal pattern, not a theoretical risk.
In February we got an inbound call from the founder of a 23-person precision-machining shop in central Ohio. They had been a Tier-3 subcontractor on a DARPA-funded prototype program for the last four years, supplying a handful of titanium-alloy components for an experimental airframe. Their annual revenue from the program was just over $1.4 million, growing.
That morning their prime had emailed a one-page amendment to their master agreement. The clause said three things. First, that DFARS 252.204-7012 had always applied to them through flowdown (it had). Second, that the prime would no longer accept new purchase orders from suppliers without a current Supplier Performance Risk System (SPRS) score posted to DoD's portal. Third, that within ninety days they expected the supplier's score to be at least 88 out of 110.
The founder had a System Security Plan template he had downloaded in 2019, blank. He had a hand-edited copy of the NIST 800-171A assessment workbook, also mostly blank. He had a Network Attached Storage box in the office closet that everybody had administrator rights to. He had no idea what CUI even meant, and he had a $1.4 million revenue line at risk.
This piece is the long version of the conversation we had with him that week. It walks through what NIST 800-171 actually costs and how long it takes for a small manufacturer, with calibrated numbers from the engagements we have run in the last 12 months. It also covers the four decisions that move the cost up or down by six figures, and a realistic 12-month plan that fits inside a working machine shop without breaking production.
Section One
What NIST 800-171 Actually Is, and What CMMC Adds
NIST Special Publication 800-171 is a US federal standard for protecting Controlled Unclassified Information (CUI) when it lives on systems that are not owned and operated by the federal government. It is 110 specific security controls grouped into 14 families, ranging from access control and configuration management to media protection and physical security. The current revision is Rev 3, released in 2024.
The standard has been an enforceable contractual obligation since DFARS clause 252.204-7012 flowed it down to every DoD supplier in 2017. The clause is mandatory in any contract or subcontract that involves CUI, and there is no minimum dollar value. A $9,000 part purchase order from a prime to a machine shop carries the same obligation as a $9 billion airframe contract.
CMMC (Cybersecurity Maturity Model Certification) is the assessment program that the Department of Defense uses to verify that contractors actually implemented NIST 800-171. CMMC 2.0, which took final-rule effect in late 2024 and started appearing in contract clauses through 2025 and 2026, defines three levels. Level 1 covers the 17 basic safeguarding requirements from FAR 52.204-21 (no CUI involved). Level 2 is the full 110 controls of NIST 800-171. Level 3 adds enhanced controls from NIST 800-172 for the most sensitive programs.
CMMC 2.0 introduced one practical change that matters to small shops: scoring. The SPRS score is calculated from your assessment of the 110 controls. Each control is worth either 1, 3, or 5 points, depending on its impact. You start at 110, and you subtract points for any control that is not fully implemented. A perfect score is 110. The DoD treats a score of 88 or higher as acceptable for most acquisitions, but the threshold is set by the prime contractor and contracting officer, not by you.
The key thing for small manufacturers to internalize: there is one technical standard (NIST 800-171), one scoring methodology (NIST SP 800-171A applied to the SPRS scoring rules), and a binary on whether an external assessor has to validate your work. Self-attestation is allowed for non-prioritized acquisitions; a C3PAO certified assessment is required for most prioritized DoD programs. Whether your particular contract requires the C3PAO path depends on the specific clauses your prime has flowed down to you, not on a universal rule.
Section Two
The Five Worst Things Small Shops Do
Every one of these is something we have seen at least twice this year. Some of them are advice the shop got from a well-meaning consultant or a competing vendor. None of them are recoverable cheaply once the spend has happened.
1. Self-scoring at 100 in SPRS because the dashboard "looks green"
SPRS scores are taken at face value by primes and contracting officers until an assessment proves them wrong. Posting a 110 or even a 105 when the real score (under honest assessment) is 62 is the single fastest way to draw a False Claims Act lawsuit. The Department of Justice has stated repeatedly that this is now an enforcement priority, and the first whistleblower cases brought against small subcontractors have gone forward. Score honestly. A truthful 72 with a credible plan to reach 88 is a better business position than a fabricated 110.
2. Treating the whole shop as in-scope for CUI
A typical 25-person machine shop has 30 workstations, 6 servers, an ERP, an email tenant, a couple of CAD seats, an MES connected to the floor, dozens of CNC controllers, a backup NAS, and a phone system. If you treat all of it as part of the NIST 800-171 environment, your implementation cost triples and your operating cost quadruples. Most shops handle CUI on three to six identified workstations and one dedicated file share. Building a small, segmented CUI enclave with a clear physical and network boundary is the largest single lever you have to reduce cost.
3. Buying a $100,000 platform before defining the boundary
Several large GRC and SIEM vendors actively sell into the small-manufacturer market with messages like "NIST 800-171 in a box." The platform is real, the controls library is real, the cost is also real, and the spend usually buys 30 percent of what the shop actually needs. The first thing to buy is consulting hours to define the scope and write the System Security Plan (SSP). The platform comes later, and the right platform for an 8-workstation enclave is much smaller and cheaper than the platform for a 600-seat enterprise.
4. Assuming Microsoft 365 Commercial is enough
Microsoft 365 Commercial does not meet the encryption-of-CUI-at-rest, FedRAMP Moderate-equivalent baseline that 800-171 effectively requires. You need GCC High (or GCC at minimum for some scopes), and you need to migrate the in-scope users only, not the whole company. Same applies to AWS (use AWS GovCloud for CUI workloads) and to certain CAD/PDM tools that store CUI in shared cloud tenants. Plan the GCC High migration as a four-to-six-week project on its own.
5. Hiring a generic IT MSP to "make us compliant"
Most local IT MSPs do excellent work on day-to-day operations and are completely the wrong fit for NIST 800-171 implementation. The standard requires control-by-control evidence, written policies, an SSP, a POAM, and continuous monitoring. None of that is in the MSP's normal contract. The shops that succeed pair their existing MSP (kept for ops) with a 800-171-specialist consultant (added for the implementation) and explicitly define the handoff between the two.
Section Three
The Five Right Moves, In Order
1. Identify your CUI before you touch anything
CUI is whatever your prime contract identifies as CUI, period. Look at the contract clauses, the security classification guides attached, and the markings on technical drawings and specifications you receive. Common categories for machine shops: Controlled Technical Information (CTI), export-controlled (ITAR/EAR), and "Controlled Unclassified Information" in the legacy DoD CUI registry. Write a one-page CUI Inventory that lists where the CUI comes from, what it covers, what format it is in, where it lives, and who handles it.
2. Draw the boundary deliberately small
Once you know where the CUI is, design a CUI enclave that touches as few systems and people as possible. The pattern that works for most shops: a dedicated VLAN for two to six workstations, GCC High Microsoft 365 licenses for three to ten users, a single secure file share, a small Windows print server, and a hardened jump host for any remote access. Engineering and quality staff who do not touch CUI stay on the regular network. CNC controllers stay on the shop-floor network. The cost of building a small enclave is a fraction of the cost of pulling the whole company into scope.
3. Run a real gap assessment against NIST 800-171A
Use the NIST 800-171A assessment objectives line by line. Not a checkbox spreadsheet from a vendor sales deck; the actual NIST workbook. Score each of the 320 assessment objectives as Met, Partially Met, or Not Met. Calculate the SPRS score from your honest answers. Document a target score and a target date. This document becomes the seed of your System Security Plan and your Plan of Action and Milestones (POAM).
4. Write the SSP early, treat it as the central artifact
The System Security Plan is the document that an assessor will read first. It describes the boundary, the data flows, the system components, the responsible roles, and how each of the 110 controls is implemented in your specific environment. A good SSP for a small shop is 40 to 90 pages, written in plain English, dated and signed by an executive. Write the first draft as soon as you have the boundary diagram, even if half the controls are still unimplemented. The SSP grows with the program.
5. Run a tabletop with your prime in attendance before assessment
Two months before the C3PAO assessment, run a three-hour internal tabletop walking through your SSP control by control. Invite your prime's small-business security liaison. They will tell you exactly what their own auditor flagged the last time around and what your assessor is likely to probe. Cheap insurance and it dramatically reduces the rework cost after the formal assessment.
Section Four
What It Actually Costs (Real Numbers)
The numbers below are blended medians from the small-manufacturer engagements we have run in the last 12 months. "Small" here means a shop with 15 to 60 employees, three to six CUI workstations in scope, GCC High for the in-scope users, and a single-site footprint. Multi-site shops or aerospace-Tier-2 manufacturers run noticeably higher.
| Cost Bucket | Year 1 (implementation) | Year 2+ (operating) |
|---|---|---|
| Consulting (gap, SSP, POAM, controls) | $32,000 to $96,000 | $6,000 to $24,000 (retainer) |
| Microsoft 365 GCC High licenses (5 to 12 users) | $2,000 to $5,500 | $3,500 to $11,000 |
| Network segmentation (firewall, switch, VLAN cabling) | $4,000 to $14,000 | $0 to $1,500 |
| EDR / endpoint hardening (3 to 8 in-scope endpoints) | $1,200 to $3,800 | $1,200 to $3,800 |
| SIEM / log management (small footprint) | $3,000 to $9,000 | $3,000 to $9,000 |
| Vulnerability scanning subscription | $1,500 to $3,800 | $1,500 to $3,800 |
| Hardware upgrades (TPM, secure print, etc.) | $2,500 to $8,000 | $0 to $1,000 |
| Internal time (operations, training) | $22,000 to $58,000 | $8,000 to $22,000 |
| Subtotal (excluding assessment) | $68,200 to $198,100 | $23,200 to $76,100 |
| C3PAO assessment (CMMC 2.0 Level 2) | $35,000 to $95,000 | Triennial |
All-in, a small shop pursuing CMMC 2.0 Level 2 certification realistically commits between $103,000 and $293,000 in Year 1, with Year 2+ operating cost in the $23,000 to $76,000 range. The triennial reassessment is a partial repeat of the original C3PAO engagement, typically 40 to 60 percent of the initial cost, depending on how much of the environment changed.
The single biggest factor pushing a shop toward the high end of these ranges is the scope of the CUI enclave. Shops that succeed in keeping CUI to 3 to 5 workstations in a single building pay near the low end. Shops that have CUI scattered across 30 workstations, two sites, and an unmanaged BYOD-laptop fleet pay near the high end, sometimes higher. The second biggest factor is whether you keep your existing IT MSP for daily operations or replace them; replacement typically adds 20 to 35 percent to Year 1 cost.
Section Five
A Realistic 12-Month Timeline
The thing that surprises most shop owners is how much of the timeline is non-technical. The SSP authoring, the policy library, the awareness training records, the vendor due diligence questionnaires, and the documentation of physical access controls take more calendar weeks than the technical controls themselves. We have seen shops complete the entire technical environment in 90 days and then spend another 150 days writing and validating the paperwork to support it.
Section Six
Self-Assessment vs C3PAO: How to Decide
Under CMMC 2.0 there are two Level 2 paths. Self-assessment is allowed for contracts the DoD has designated as non-prioritized; the contractor submits the SPRS score and an attestation. C3PAO assessment is required for contracts designated as prioritized, which covers a significant share of DoD acquisitions and most DARPA programs. The designation is set in the contract clauses your prime flows down. The decision flow looks like this:
A surprising number of shops we work with end up on a hybrid path. They self-attest for their current contract base in Year 1 to keep the existing purchase orders flowing, while running a parallel 12-month plan to be ready for a C3PAO assessment in Year 2 when their primes are expected to move them to the prioritized path. This split-track approach is cheaper, less risky, and uses the same SSP and POAM artifacts for both stages.
How Atlant Security Helps
NIST 800-171 / CMMC 2.0 for Small Manufacturers
We run NIST 800-171 implementations end to end for small precision-machining, aerospace, and DARPA-prototype suppliers. Senior consultant on every engagement, fixed-scope deliverables, and a working relationship with several C3PAOs so the assessment booking is part of the plan.
- Fixed-fee scoping engagement from $6,000, delivered in two weeks
- Full implementation programs from $48,000 for a 5-workstation enclave
- Honest, defensible SPRS score posted to DoD on your behalf
- POAM that targets a realistic 88+ within 9 months
- Tabletop coaching before C3PAO assessment
Frequently Asked
Questions We Hear From Shop Owners
Do I really need to do this if my contract is only $80,000 a year?
If the contract includes DFARS 252.204-7012 and you handle any CUI under it, then yes. The clause does not have a minimum dollar threshold. That said, the right answer for some shops is to negotiate the CUI flow-down out of the contract entirely; if you do not actually receive any technical drawings or specs marked CUI, you may be able to argue that you are not in scope. Have your prime confirm in writing what they consider CUI and what they do not.
Can I share an SPRS score across multiple primes?
Yes, the SPRS score is calculated per assessment scope, not per contract. If your CUI enclave is the same across multiple primes (which it usually is for a small shop), one score and one SSP cover all of them. You will, however, see different primes ask for different supporting documentation; the SSP and the POAM are common to all, while flow-down attestation letters are usually prime-specific.
My MSP says they "do CMMC." Should I just let them run it?
Some MSPs do. The honest test: ask them to show you a sample SSP they have written for a previous client (redacted), the gap-assessment workbook from a previous NIST 800-171 engagement, and the SPRS scoring methodology they apply. If they hesitate or substitute marketing materials, they do not. Good NIST 800-171 work is mostly authoring and assessment, not configuration; an MSP whose entire delivery is "we install EDR and a SIEM" is not running CMMC, they are running tooling.
How does Microsoft 365 GCC High pricing actually work?
GCC High is sold through authorized Microsoft partners (not direct on the Microsoft store). Licensing typically runs $36 to $58 per user per month for the E3-equivalent tier and $58 to $95 per user per month for E5-equivalent, depending on partner markup. There is also a one-time tenant setup cost ($2,000 to $8,000) and a separate migration project if you are moving existing mailboxes and OneDrive content. For a CUI enclave covering five to twelve users, total Year 1 license + setup cost is typically $3,500 to $9,000.
What happens at the C3PAO assessment, day by day?
A typical CMMC 2.0 Level 2 assessment for a small shop runs three to five days onsite plus two to three weeks of remote prep and follow-up. Day 1 is a kickoff and walkthrough. Days 2 to 4 are interviews with control owners and evidence review. The final day is a draft findings readout. After the onsite, the C3PAO produces a written report and submits the result to the CMMC Accreditation Body. From kickoff to certification posted, expect 8 to 14 weeks.
If I fail the C3PAO assessment, what happens?
A failed assessment is not the end. The C3PAO will issue a report identifying which controls were Not Met. You have a window (typically 180 days) to remediate and either rerun the relevant portions of the assessment or, for some lower-impact gaps, accept the conditional certification with an active POAM. The cost of remediation depends entirely on which controls failed. Failing on documentation issues is cheap; failing on architecture issues (no network segmentation, no GCC High) can be expensive.
If your prime has just emailed you a clause amendment and a 90-day deadline, the most important thing to do this week is not to panic-buy software. It is to schedule a 60-minute call with your prime's small-business security liaison, ask them to walk you through which contracts carry which CUI obligations, and confirm in writing what they actually expect from you in 90 days. Half the small shops we work with discover at that call that the prime's real ask is "post an honest SPRS score and a credible POAM," which is a six-week piece of work, not a six-figure one.
The other half discover that they are in fact on the C3PAO path and that the next twelve months are going to be busy. That is still recoverable. Start with scope, get the SSP drafted, build a small enclave, and book the assessment for Month 10. The shops that fail are not the ones that start late; they are the ones that try to compress the program into ninety days and end up with a half-implemented environment that no assessor will pass.
Have a CMMC clause on your desk and a 90-day deadline? Book a 30-minute scoping call or email alexander@atlantsecurity.com directly.
Alexander Sverdlov
Founder of Atlant Security. Author of 2 information security books, cybersecurity speaker at the largest cybersecurity conferences in Asia and a United Nations conference panelist. Former Microsoft security consulting team member, external cybersecurity consultant at the Emirates Nuclear Energy Corporation.